TLS cert per cluster for lens-k8s-proxy (#5081)

Co-authored-by: Sebastian Malton <sebastian@malton.name>

src/main/context-handler/context-handler.ts

@@ -28,7 +28,7 @@ interface PrometheusServicePreferences {
 
 interface Dependencies {
   createKubeAuthProxy: CreateKubeAuthProxy;
-  authProxyCa: Promise<Buffer>;
+  authProxyCa: string;
 }
 
 export class ContextHandler {
@@ -123,7 +123,7 @@ export class ContextHandler {
     return `https://127.0.0.1:${this.kubeAuthProxy.port}${this.kubeAuthProxy.apiPrefix}${path}`;
   }
 
-  async resolveAuthProxyCa() {
+  resolveAuthProxyCa() {
     return this.dependencies.authProxyCa;
   }
 
@@ -140,7 +140,7 @@ export class ContextHandler {
   protected async newApiTarget(timeout: number): Promise<httpProxy.ServerOptions> {
     await this.ensureServer();
 
-    const caFileContents = await this.resolveAuthProxyCa();
+    const ca = this.dependencies.authProxyCa;
     const clusterPath = this.clusterUrl.path !== "/" ? this.clusterUrl.path : "";
     const apiPrefix = `${this.kubeAuthProxy.apiPrefix}${clusterPath}`;
 
@@ -150,7 +150,7 @@ export class ContextHandler {
         host: "127.0.0.1",
         port: this.kubeAuthProxy.port,
         path: apiPrefix,
-        ca: caFileContents.toString(),
+        ca,
       },
       changeOrigin: true,
       timeout,

src/main/context-handler/create-context-handler.injectable.ts

@@ -3,23 +3,27 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
+import selfsigned from "selfsigned";
 import type { Cluster } from "../../common/cluster/cluster";
 import { ContextHandler } from "./context-handler";
 import createKubeAuthProxyInjectable from "../kube-auth-proxy/create-kube-auth-proxy.injectable";
-import kubeAuthProxyCaInjectable from "../kube-auth-proxy/kube-auth-proxy-ca.injectable";
+import { getKubeAuthProxyCertificate } from "../kube-auth-proxy/get-kube-auth-proxy-certificate";
+import URLParse from "url-parse";
 
 const createContextHandlerInjectable = getInjectable({
   id: "create-context-handler",
 
   instantiate: (di) => {
-    const authProxyCa = di.inject(kubeAuthProxyCaInjectable);
+    return (cluster: Cluster) => {
+      const clusterUrl = new URLParse(cluster.apiUrl);
 
-    const dependencies = {
-      createKubeAuthProxy: di.inject(createKubeAuthProxyInjectable),
-      authProxyCa,
+      const dependencies = {
+        createKubeAuthProxy: di.inject(createKubeAuthProxyInjectable),
+        authProxyCa: getKubeAuthProxyCertificate(clusterUrl.hostname, selfsigned.generate).cert,
+      };
+
+      return new ContextHandler(dependencies, cluster);
     };
-
-    return (cluster: Cluster) => new ContextHandler(dependencies, cluster);
   },
 });